March 7, 2019
Albany, NY

Governor Cuomo Launches Consumer Education Initiative for Digital Marketplace Consumers

TOP Governor Cuomo Launches Consumer Education...

Initiative, Beginning with an Analysis of Venmo's Privacy Policy, Announced as Part of Investigation into Facebook Over Access to Personal Information


Division of Consumer Protection Will Proactively Inform Consumers of Potential Privacy Pitfalls of the Digital Age


Governor Andrew M. Cuomo today announced that, in conjunction with a recently announced investigation into reports that Facebook is secretly accessing personal information of users, the New York State Division of Consumer Protection is launching an education initiative for the digital age, including an examination of the terms of service and privacy policies of popular web applications and services. Following this examination of each company's terms of service, the Division of Consumer Protection will make policy recommendations and take other appropriate steps to ensure and bolster consumer protections as necessary.


The consumer education initiative begins with an analysis of the privacy policy of the popular application Venmo. The Division of Consumer Protection will issue future consumer education pieces regarding terms of service and privacy policies of additional apps and services in the coming months. Governor Cuomo announced the education program during the 2019 National Consumer Protection Week.


"When it comes to consumer privacy in the digital age, the devil is always in the details," Governor Cuomo said. "By arming New Yorkers with easy-to-digest knowledge about the possible misleading or hidden language detailing how companies use personal information, consumers will be better able to protect themselves and decide which apps and services they actually want to use."


"We are taking action to ensure that the personal information of all New Yorkers is safe and protected," said Lieutenant Governor Kathy Hochul. "This education initiative spearheaded by the State Division of Consumer Protection will review policies and services to make sure consumers are well informed and don't become victims of fraud."


"Our marketplace has evolved to exist primarily online, bringing both boundless opportunities and potential pitfalls and scams," said New York Secretary of State Rossana Rosado, who oversees the Division of Consumer Protection. "By closely examining the nuances of privacy, information sharing and specific terms for popular online services and applications, New York State is equipping today's consumers with the most important information available."


Venmo, a popular cash transfer digital application, is just one of many applications where a user can login via Facebook credentials. Launched in 2009, Venmo is a cash transfer digital application that is commonly used to pay peers for everyday items such as drinks with friends, shared cab rides, donations, etc. PayPal, Inc. is the parent company of Venmo.


Venmo's privacy policy states that their app shares user information with third parties - even after the user discontinues using the app. The privacy policy also notes that even if a user selects "Do Not Track" on their browser settings for the app, Venmo disregards the setting.


As an application, their privacy policy and user agreements were updated March 29, 2018 and July 27, 2018 respectively. The privacy policy, which is more extensive than the user agreement changes, was again updated December 20, 2018. The current Privacy Policy can be found online. The Division of Consumer Protection is highlighting five areas that consumers should be aware of:


Data of Former Users:


What it says: "APPLICABILITY OF PRIVACY POLICY:When you are no longer our customer, we continue to share your information as described in this policy."


What it means: Even if someone is no longer a customer, Venmo will continue to share their information. It is unclear from the policy how long Venmo maintains the information.


Cookies and Other Tracking Technology:


What it says: "THE INFORMATION WE COLLECT:Identification Information - your name, street address, email address, date of birth, and SSN (or other governmental issued verification numbers)."


What it means: Besides collecting the obvious (financial information in order to make cash transfers), Venmo also collects the user's government-issued ID numbers, provided by the user, including a social security number.


What it says: "HOW WE USE COOKIES:Certain aspects and features of the Venmo Services and our website are only available through the use of Cookies, so if you choose to disable or decline Cookies, your use of the websites and Venmo Services may be limited or not possible."


What it means: Cookies recognize the user as a customer of Venmo. The policy states that if the user denies access to this information on their platform, they will not be able to "fully use" the platform.


What it says: "HOW WE USE COOKIES: Do Not Track: Do Not Track ("DNT") is an optional browser setting that allows you to express your preferences regarding tracking by advertisers and other third-parties. We do not respond to DNT signals.


What it means: This means that even if the user has "Do Not Track" set on their browser, Venmo ignores it.


Third Parties:


What it says: "HOW WE SHARE PERSONAL INFORMATION WITH OTHER PARTIES:We may share your personal information with: Other third parties with your consent or at your direction to do so, including if you authorize an account connection with a third-party account or platform.For the purposes of this privacy policy, an "account connection" with such a third party is a connection you authorize or enable between your Venmo account and a non-Venmo account, payment instrument, or platform that you lawfully control or own. When you authorize such a connection, Venmo and the third-party will exchange your personal information and other information directly. Examples of account connections include: linking your Venmo account to a social media account or social messaging service; connecting your Venmo account to a third-party data aggregation or financial services company, if you provide such company with your Venmo account log-in credentials; or using your Venmo account to make payments to a merchant or allowing a merchant to charge your Venmo account."


What it means: If a user authorizes a third-party connection, Venmo and that third party will exchange information. This includes any social media applications you use to log into your Venmo account.


Using Venmo for Transactions:


When a user pays a business using Venmo, their information will be sent to that business to complete the transaction. The details of what information will be shared is complex:

  • Venmo states that they share the information to complete everyday transactions, to market Venmo products and services and to jointly market to the user with other financial companies.
  • Venmo also shares information about the transactions and experiences with "affiliates," which are typically third-party marketing companies who sell the information to other companies.


In their privacy policy, Venmo includes the below chart:


Reasons we can share your personal information

Does Venmo share?

Can you limit this sharing?

For our everyday business purposes—
such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit bureaus



For our marketing purposes—
to offer our products and services to you



For joint marketing with other financial companies



For our affiliates' everyday business purposes—
information about your transactions and experiences



For our affiliates' everyday business purposes—
information about your creditworthiness


We don't share

For our affiliates to market to you


We don't share

For nonaffiliates to market to you


We don't share


Messaging Apps:


What it says: "If you choose to use Siri or iMessage to send payments via Venmo or to otherwise use the Venmo Services, such use is subject to Apple's terms and conditions for use of iMessage and/or Siri, as applicable, and the terms of the Venmo User Agreement. By using Siri or iMessage, you authorize us to share some of your Venmo account data (including your friends list, list of persons you have transacted with most recently and most frequently, transaction instructions, and transaction notes) with Apple to allow it to facilitate transaction requests made through Siri or iMessage on iOS. Data shared with Apple will be used pursuant to Apple's then-current user agreements and privacy policies. You can grant or revoke Apple's access to Venmo on iOS at any time under the "Siri" or "iMessage" settings on your iPhone."


What it means: Venmo's privacy policy now states that if a user uses Siri or other iOS messaging apps, other information like the user's friends list, list of people they transact with regularly and other related information will be shared with Apple.


The Division of Consumer Protection's education initiative will continue a comprehensive dive into the myriad language in various terms of service that consumers willingly acknowledge every day in the digital marketplace - often without reading or fully understanding. The Division of Consumer Protection will examine and decipher these often-complex terms of service, and then inform the public of any significant language.


The terms of service and user agreements being examined should not be construed to indicate that the companies providing them are engaged in any wrongdoing, or nefarious or fraudulent behavior. This initiative is meant to remind consumers that the terms and conditions of the products/services include important information that could affect their personal privacy.


The Division of Consumer Protection's Consumer Helpline is 800-697-1220, available Monday to Friday, from 8:30 a.m. to 4:30 p.m. Consumer complaints can be filed at any time via the Division's website. The Division can also be reached via Twitter at @NYSConsumer or Facebook at


Contact the Governor's Press Office
Contact the Governor's Press Office